# local_ydb_apply_auth_hardening

Apply a reviewed hardened YDB config file and restart local-ydb so auth settings take effect. Use only after preparing and reviewing the config; without confirm=true this returns the apply/restart plan only.

Agent View of the PolicyLayer registry record for `local_ydb_apply_auth_hardening`. HTML page: https://policylayer.com/tools/local-ydb/local-ydb-apply-auth-hardening

## Facts

- Tool: `local_ydb_apply_auth_hardening`
- Server: Local Ydb (`@astandrik/local-ydb-mcp`) — https://policylayer.com/tools/local-ydb.md
- Install: `npx -y @astandrik/local-ydb-mcp`
- Homepage: git+https://github.com/astandrik/local-ydb-toolkit.git
- Risk category: Execute (High risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "local_ydb_apply_auth_hardening",
    "arguments": {}
  }
}
```

## Why local_ydb_apply_auth_hardening is rated High

This tool applies a configuration file and restarts a running YDB service, which constitutes executing an external operation with significant system-level effects. While it modifies configuration (Write), the service restart and auth reconfiguration elevate it to Execute. Misuse could lock out users or disrupt the database service, making severity high.

From the tool's own definition: "'restart local-ydb so auth settings take effect' — applies a config file and restarts the service; 'without confirm=true this returns the apply/restart plan only' indicates a confirmed execution path that triggers external operations"

## Use case

AI agents invoke local_ydb_apply_auth_hardening to trigger actions in Local Ydb. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Local Ydb:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "local_ydb_apply_auth_hardening": {
      "limits": [
        {
          "counter": "local_ydb_apply_auth_hardening_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Local Ydb (37)

- `local_ydb_cleanup_storage` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-cleanup-storage.md
- `local_ydb_destroy_stack` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-destroy-stack.md
- `local_ydb_remove_dynamic_nodes` — Destructive — https://policylayer.com/tools/local-ydb/local-ydb-remove-dynamic-nodes.md
- `local_ydb_add_dynamic_nodes` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-add-dynamic-nodes.md
- `local_ydb_bootstrap` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-bootstrap.md
- `local_ydb_bootstrap_root_database` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-bootstrap-root-database.md
- `local_ydb_check_prerequisites` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-check-prerequisites.md
- `local_ydb_pull_image` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-pull-image.md
- `local_ydb_restart_stack` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-restart-stack.md
- `local_ydb_start_dynamic_node` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-start-dynamic-node.md
- `local_ydb_upgrade_version` — Execute — https://policylayer.com/tools/local-ydb/local-ydb-upgrade-version.md
- `local_ydb_auth_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-auth-check.md
- `local_ydb_container_logs` — Read — https://policylayer.com/tools/local-ydb/local-ydb-container-logs.md
- `local_ydb_database_status` — Read — https://policylayer.com/tools/local-ydb/local-ydb-database-status.md
- `local_ydb_dump_tenant` — Read — https://policylayer.com/tools/local-ydb/local-ydb-dump-tenant.md
- `local_ydb_generate_schema` — Read — https://policylayer.com/tools/local-ydb/local-ydb-generate-schema.md
- `local_ydb_graphshard_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-graphshard-check.md
- `local_ydb_healthcheck` — Read — https://policylayer.com/tools/local-ydb/local-ydb-healthcheck.md
- `local_ydb_inventory` — Read — https://policylayer.com/tools/local-ydb/local-ydb-inventory.md
- `local_ydb_list_dumps` — Read — https://policylayer.com/tools/local-ydb/local-ydb-list-dumps.md
- `local_ydb_list_versions` — Read — https://policylayer.com/tools/local-ydb/local-ydb-list-versions.md
- `local_ydb_nodes_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-nodes-check.md
- `local_ydb_pull_status` — Read — https://policylayer.com/tools/local-ydb/local-ydb-pull-status.md
- `local_ydb_reduce_storage_groups` — Read — https://policylayer.com/tools/local-ydb/local-ydb-reduce-storage-groups.md
- `local_ydb_scheme` — Read — https://policylayer.com/tools/local-ydb/local-ydb-scheme.md
- `local_ydb_status_report` — Read — https://policylayer.com/tools/local-ydb/local-ydb-status-report.md
- `local_ydb_storage_leftovers` — Read — https://policylayer.com/tools/local-ydb/local-ydb-storage-leftovers.md
- `local_ydb_storage_placement` — Read — https://policylayer.com/tools/local-ydb/local-ydb-storage-placement.md
- `local_ydb_tenant_check` — Read — https://policylayer.com/tools/local-ydb/local-ydb-tenant-check.md
- `local_ydb_add_storage_groups` — Write — https://policylayer.com/tools/local-ydb/local-ydb-add-storage-groups.md
- …and 7 more: https://policylayer.com/tools/local-ydb.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=local-ydb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/local-ydb